Adding IPv6 feels low-risk: IPv4 keeps working, you are only adding a second protocol. That is exactly the trap. The moment you hand out an IPv6 prefix, every client auto-configures a globally reachable address — and your carefully built IPv4 firewall does not apply to a single byte of it. Dual-stack done carelessly turns a NAT-protected network into a publicly routable one with no filter. Done right, it is a clean additive migration.
IPv4 on a typical LAN is protected partly by a firewall and partly by an accident of history: NAT means inside hosts have no publicly routable address, so even a weak ruleset is not directly reachable from the internet. IPv6 removes that accident. Addresses are global and end-to-end by design — which is the point — so the firewall is now the only thing between the internet and every device.
And here is the sharp edge: an IPv6 firewall is a completely separate ruleset from IPv4. Your /ip firewall rules do nothing for /ipv6 firewall. Clients turn IPv6 on by themselves the instant a router advertisement appears, so if you hand out a prefix before building the v6 filter, every host is globally reachable with no firewall at all. The migration is safe only if the v6 ruleset exists first.
01
IPv4 keeps its firewall and its NAT. IPv6 arrives global and end-to-end — and unless you built its filter, it is wide open.
02
Build the v6 firewall before anything is reachable, then enable addressing one VLAN at a time — v4 is never touched.
| Step | Do | Rollback |
|---|---|---|
| 1 · Get the prefix | Request a prefix via DHCPv6-PD on the WAN. Do not advertise anything to clients yet. | Release the PD. |
| 2 · Build the v6 firewall | Write the /ipv6 firewall ruleset to mirror v4: default-deny inbound, allow established/related, permit only what v4 permits. Before any RA. | — (nothing reachable yet). |
| 3 · Pilot one VLAN | Enable SLAAC/DHCPv6 and router advertisements on one low-risk VLAN. Clients gain a v6 address. | Disable RA on that VLAN — clients drop v6. |
| 4 · Verify parity | From outside, confirm v6 reachability matches v4 exactly (nothing extra open). From inside, confirm v6 connectivity works. | — |
| 5 · Roll out + RA guard | Repeat per VLAN; enable RA guard on access ports so only the router advertises. | Per-VLAN disable RA. |
# default-deny inbound on v6, mirroring the v4 input/forward policy /ipv6 firewall filter add chain=input action=accept connection-state=established,related,untracked # ICMPv6 is load-bearing — do NOT drop it (ND, PMTUD, SLAAC) add chain=input action=accept protocol=icmpv6 add chain=input action=accept in-interface-list=MGMT add chain=input action=drop add chain=forward action=accept connection-state=established,related,untracked add chain=forward action=accept in-interface-list=LAN out-interface-list=WAN add chain=forward action=drop # no inbound from the internet, same as v4 # ONLY NOW enable addressing (step 3): /ipv6 dhcp-client add interface=ether1-wan request=prefix pool-name=v6pd \ pool-prefix-length=56
Two reflexes to resist. First, ICMPv6 is not optional like ICMP felt in v4 — Neighbor Discovery, PMTUD and address configuration all ride it, so a blanket drop breaks v6 entirely (and gives you a black hole). Permit it. Second, the instinct to “NAT v6 like v4 for safety” (NPTv6/NAT66) throws away the end-to-end addressing that is the whole point; the correct protection is the firewall, default-deny inbound, not NAT. Build the filter, keep the global addresses.
03
| Before you advertise a prefix | Why |
|---|---|
| The v6 firewall exists and is default-deny | Clients auto-enable v6 the instant an RA appears — the filter must predate it. |
| ICMPv6 permitted | v6 does not work at all without it. |
| External scan v4 vs v6 after each VLAN | Prove v6 exposes exactly what v4 does — nothing extra. |
| RA guard on access ports | Stop a rogue device advertising itself as the v6 router. |
Takeaways
Dual-stack is safe when the IPv6 firewall is built before the prefix is handed out. I roll IPv6 across a live network per VLAN, mirroring every v4 rule in v6, so nothing becomes reachable that was not meant to be.
Book a Discovery Call →